20.1 Pivoting, Relays, and Additional Credential Capture
Key Takeaways
- Domain 5 Post-exploitation and Lateral Movement is 14 percent of PT0-003; objective 5.2 is movement after a foothold — hop, then re-enumerate — not a tunnel cookbook.
- Pivoting uses a compromised host as a hop to a network the tester laptop could not reach; 4.2 only named the multihomed NIC, and VLAN hopping is a different 4.2 attack.
- Relay creation in 5.2 is a SOCKS or port-forward path so tester tools exit on the foothold; it is not 4.2 NTLM relay of a live authentication.
- After you land, Domain 2 maps are stale: service discovery, network traffic discovery, additional credential capture, credential dumping, and string searches restart from the new position.
- String searches with findstr or strings hunt passwords in scripts and shares; Mimikatz-style dumping on the new host is additional 5.2 capture, not a reason to dump NTDS.dit from a workstation.
Domain 5, Post-exploitation and Lateral Movement, is 14 percent of CompTIA PenTest+ PT0-003. Objective 5.2 — Given a scenario, perform lateral movement — starts after you already occupy a host. Persistence (5.1) was how you stay. Lateral movement is how you reach the next place. This section covers pivoting, relay creation, and the enumeration CompTIA lists under 5.2: service discovery, network traffic discovery, additional credential capture, credential dumping, and string searches. Named remote services wait for 20.2. Named tools wait for 20.3. CompTIA is scoring identification — hop versus credential-forward, second-wave enum versus first-foothold dump — not a tunnel cookbook. This guide will not give SOCKS bind recipes, proxy configuration files, or SSH forwarding command lines.
Pivoting: the hop, not the extra NIC
Pivoting is using a compromised host as a hop to a network the tester laptop could not reach on its own. The foothold already sits where you need to sit. Later scans, shells, and file copies go through that host so they appear to originate on its segment.
4.2 named the candidate. 5.2 uses it. Objective 4.2 asked you to recognize a multihomed host — two NICs, a NIC plus a VPN adapter, a workstation on the user VLAN and a restricted OT or DMZ network. That was inventory. 5.2 is the pivot: you treat that second interface as a path and you send work across it. Exam trap: answering multihomed when the stem already has a foothold on the dual-home and asks how the tester reaches the hidden subnet. Trap two: calling the pivot VLAN hopping. Hopping (4.2) abuses 802.1Q on a trunk-adjacent port from a single path. Pivoting reuses a compromised OS that already has a legitimate Layer-3 route.
When you pick pivoting: the interesting hosts live on a subnet, VLAN, or VRF the tester VLAN cannot route to, and you already control a host that can. When you do not: you are still on the same broadcast domain as the target (ordinary post-exploit on a reachable host), or the stem is only ipconfig showing a second NIC with no movement yet (still 4.2).
A pivot is not automatically Domain Admin. It is reachability. Credentials, protocols, and tools still have to match on the far side. A double-hop — jump box, then a second internal host — is still pivoting conceptually. You do not need a chaining recipe on the exam; you need to say the tester is using occupied hosts as hops rather than attacking from the original laptop address.
Pivots also inherit rules of engagement. An OT, PCI, or out-of-scope guest wireless segment that happens to be plugged into the jump box is not automatically fair game because you can route there. Record the path. Confirm the far network is in the statement of work before you treat the hop as a license to scan it.
Relay creation: SOCKS and port-forward, not NTLM relay
Relay creation in 5.2 is building a forwarding path so tester tools can talk through the foothold. Conceptually that is a SOCKS proxy — applications send TCP through a proxy listener that exits on the compromised host — or a port forward — a local port on the tester maps to a host and port only the foothold can see. The payload of the relay is your later traffic, not someone else's authentication handshake.
This is not 4.2 NTLM relay. Objective 4.2 relay forwards a live NTLM (or similar) authentication to a second host when signing is off. Tools in that story were Impacket and CrackMapExec as the Windows check-and-forward family. 5.2 relay creation is how your scanner and your shell get a path. Exam trap: picking NTLM relay whenever the word relay appears. If the stem says create a SOCKS path, port-forward to internal RDP, or make tools appear to come from the jump box, the answer is 5.2 relay creation. If the stem says signing is off and forward the captured authentication, the answer is still 4.2.
When you pick relay creation: you need a reusable path for multiple tools, or you need one specific internal listener (RDP, WinRM, an HTTPS admin UI) that only the foothold can reach. When you do not: you already have a native session on the far host, or the problem is borrow the live logon rather than borrow the route.
Relays are still in-scope and still loud. A SOCKS path that then runs a noisy fleet scan from the jump box is a rules of engagement problem, not a free pass because the packets came from inside. Exam trap two: treating every Metasploit session as automatically a relay. A session is a foothold. Autoroute-style use of that session as a route is the 5.2 idea; the named tools belong in 20.3.
Enumerate again after you land
The first recon (Domain 2) mapped what the tester laptop could see. After a pivot, that map is stale. 5.2 explicitly restarts enumeration from the new position.
Service discovery is what is listening on the newly visible network: SMB and fileshares, RDP and VNC, SSH, LDAP, RPC, FTP, Telnet, HTTP/HTTPS admin UIs, printer protocols, and the rest of the 20.2 list. You are not re-scoring Domain 2 Nmap trivia. You are asking, now that I sit on 10.50.0.0/24, what is actually here?
Network traffic discovery is what the compromised host already talks to. Established connections, ARP or neighbor tables, DNS cache, default routes, and captured traffic from this vantage show the real next hop better than a blind sweep. Netstat and route as living-off-the-land binaries belong in 20.3; the idea belongs here: follow existing conversations. Exam trap: blasting a full TCP sweep into OT because enumeration always means scan. Traffic discovery is often quieter and more accurate.
Additional credential capture is new secrets that this position can see: a different user's interactive logon, a service account the jump box uses to mount a share, an SNMP community on the OT VLAN, a browser saved password, a scheduled-task password in an XML file. You did not have these from the first workstation dump.
Credential dumping in 5.2 is another dump on another host (or a deeper dump now that you have a better integrity level). Objective 4.4 introduced dumping LSASS, SAM, and NTDS.dit with Mimikatz as the named tool. 5.2 is why you do it again: each new host is a new secret store. Exam trap: treating every Mimikatz mention as 4.4 only. If the stem is mid-lateral-movement and the tester dumps the jump box to unlock the next hop, that is 5.2 additional dumping. Trap two: dumping NTDS from a workstation because dumping is dumping. NTDS.dit still lives on a domain controller.
String searches are the quiet cousin of dumping. findstr.exe (Windows) and strings (binaries, memory images, scripts) hunt for password, connection strings, API keys, BEGIN RSA, and unattend-style leftovers. Typical places after a foothold: scheduled-task XML, web.config and .env files, backup scripts on a share, PowerShell history, and installer leftovers. CompTIA lists string searches under 5.2 enumeration because lateral movement often starts with a password someone left in a file, not with a new exploit. Exam trap: calling findstr a 2.3 recon script. Using it after a foothold to unlock the next host is 5.2.
Capture versus dump is a matching distinction. Capture is whatever this position newly observes — a hash on the wire, a password in a script, a ticket in a new logon. Dump is extracting the host's stored secrets (LSASS, SAM, and similar). Both are 5.2 when they happen because you moved. Neither is a command block in the report.
Worked hop
WS-042 is a domain workstation on 10.4.20.0/24. Host inventory (4.2) showed a second NIC on 10.50.0.0/24 (OT). That was multihomed. 5.2 is the pivot: the tester uses WS-042 as the hop so scanners and shells reach OT. Relay creation is the SOCKS-style or port-forward path that makes the tester's tools exit on WS-042 — not an NTLM relay against FILE01 on the user VLAN. From that vantage, network traffic discovery shows WS-042 already talks SMB to FILE-OT and a limited TCP session to a PLC. Service discovery on the new subnet finds RDP on an HMI, Telnet (cleartext) on a legacy controller, and an HTTP printer UI. String searches on a backup script hit a service-account password. Additional credential capture and a credential dump on WS-042 (Mimikatz conceptually, after the 4.4 privilege story) turn that password and any live OT logon into the next hop's authentication material. None of that is a tunnel recipe. Name the hop, name the relay as a path, name the second-wave enum.
| Technique | What it does | When you pick it | Exam trap |
|---|---|---|---|
| Pivot | Use a compromised host as a hop to an unreachable network | Dual-home or jump box already occupied; tester VLAN cannot route there | Calling 4.2 multihomed the movement itself; calling it VLAN hopping |
| Relay creation | SOCKS or port-forward path so tools exit on the foothold | Need a reusable path or one internal listener | 4.2 NTLM relay / Impacket live-auth forward |
| Service discovery | Find listeners on the newly visible net | After the hop, the Domain 2 map is stale | Re-scoring 2.2 as if you never left the tester laptop |
| Network traffic discovery | See what the foothold already talks to | netstat, route, or capture from the box | Blind-scanning OT because that is enum |
| Additional creds / dump | New secrets from the new position | New host, new user, new share | Mimikatz-only as 4.4; NTDS from a workstation |
| String searches | findstr or strings for passwords and keys in files | Scripts, unattend leftovers, shares, binaries | Calling findstr a Domain 2 OSINT tool |
Sequence on the exam: identify that you cannot reach the far net from the laptop, pick pivot, create a relay (path, not NTLM), then enumerate again — services, existing traffic, string searches, additional dumps — before you pick a protocol in 20.2.
A foothold on WS-042 shows a second NIC on an OT subnet the tester laptop cannot route to. The stem asks how the tester reaches hosts on that OT subnet. Which 5.2 reading is exam-correct?
After a foothold, the tester needs RDP on an internal HMI that only the jump box can reach, and wants later scanner traffic to exit on that jump box. Which 5.2 technique is that?
The tester has just pivoted onto WS-042's OT NIC. Which 5.2 enumeration set should restart from that new position?